diff --git a/src/ctap2.rs b/src/ctap2.rs
index 511becf..8cf9cf9 100644
--- a/src/ctap2.rs
+++ b/src/ctap2.rs
@@ -1448,6 +1448,10 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
                 .transpose()?
                 .unwrap_or(PinProtocolVersion::V1);
 
+            if !get_assertion_state.up_performed {
+                return Err(Error::UnsupportedOption);
+            }
+
             // We derive credRandom as an hmac of the existing private key.
             // UV is used as input data since credRandom should depend UV
             // i.e. credRandom = HMAC(private_key, uv)
diff --git a/tests/basic.rs b/tests/basic.rs
index 5e0b684..1fd014b 100644
--- a/tests/basic.rs
+++ b/tests/basic.rs
@@ -774,6 +774,11 @@ impl TestGetAssertion {
         if !self.rk && !self.allow_list {
             return Some(0x2e);
         }
+        if let Some(options) = self.options {
+            if options.up == Some(false) && self.ga_hmac_secret {
+                return Some(0x2b);
+            }
+        }
         None
     }
 }